CVE-2023-26302 - Vulnerability Details - OpenCVE

Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00021.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Executablebooks	Markdown-it-py

Configuration 1 [-]

cpe:2.3:a:executablebooks:markdown-it-py:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-0130	Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.
Github GHSA	GHSA-jrwr-5x3p-hvc3	markdown-it-py Denial of Service vulnerability in the command line interface

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c
https://nvd.nist.gov/vuln/detail/CVE-2023-26302
https://www.cve.org/CVERecord?id=CVE-2023-26302

History

Tue, 11 Mar 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2023-02-22T22:02:35.556Z

Updated: 2025-03-11T18:23:39.942Z

Reserved: 2023-02-21T22:36:47.685Z

Link: CVE-2023-26302

Vulnrichment

Updated: 2024-08-02T11:46:23.950Z

NVD

Status : Modified

Published: 2023-02-22T23:15:17.677

Modified: 2025-03-11T19:15:38.520

Link: CVE-2023-26302

Redhat

Severity : Moderate

Publid Date: 2023-02-23T11:08:00Z

Links: CVE-2023-26302 - Bugzilla

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-26302", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2023-02-21T22:36:47.685Z", "datePublished": "2023-02-22T22:02:35.556Z", "dateUpdated": "2025-03-11T18:23:39.942Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/executablebooks/markdown-it-py/releases", "defaultStatus": "unaffected", "packageName": "markdown-it-py", "platforms": ["Linux", "MacOS", "Windows"], "product": "markdown-it-py", "repo": "https://github.com/executablebooks/markdown-it-py", "vendor": "Executable Books", "versions": [{"changes": [{"at": "commit 53ca3e9", "status": "unaffected"}], "lessThan": "v2.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mark Esler"}, {"lang": "en", "type": "remediation developer", "value": "Chris Sewell"}], "datePublic": "2023-02-22T05:39:56.000Z", "descriptions": [{"lang": "en", "value": "Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.\n"}], "impacts": [{"capecId": "CAPEC-267", "descriptions": [{"lang": "en", "value": "CAPEC-267"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "LOW", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-173", "description": "CWE-173", "lang": "en", "type": "CWE"}]}], "timeline": [{"lang": "en", "time": "2023-02-07T14:19:00.000-06:00", "value": "Reported to upstream."}, {"lang": "en", "time": "2023-02-22T06:39:56+01:00", "value": "Patched by upstream."}], "references": [{"tags": ["patch"], "url": "https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c"}], "title": "markdown-it-py CLI crash on invalid UTF-8 characters", "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2023-02-22T22:02:35.556Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:46:23.950Z"}, "title": "CVE Program Container", "references": [{"tags": ["patch", "x_transferred"], "url": "https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c"}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-173", "lang": "en", "description": "CWE-173 Improper Handling of Alternate Encoding"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-11T18:23:16.508837Z", "id": "CVE-2023-26302", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T18:23:39.942Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c", "tags": ["patch", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:46:23.950Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-26302", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-11T18:23:16.508837Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-173", "description": "CWE-173 Improper Handling of Alternate Encoding"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T18:23:32.675Z"}}], "cna": {"title": "markdown-it-py CLI crash on invalid UTF-8 characters", "credits": [{"lang": "en", "type": "finder", "value": "Mark Esler"}, {"lang": "en", "type": "remediation developer", "value": "Chris Sewell"}], "impacts": [{"capecId": "CAPEC-267", "descriptions": [{"lang": "en", "value": "CAPEC-267"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/executablebooks/markdown-it-py", "vendor": "Executable Books", "product": "markdown-it-py", "versions": [{"status": "affected", "changes": [{"at": "commit 53ca3e9", "status": "unaffected"}], "version": "0", "lessThan": "v2.2.0", "versionType": "semver"}], "platforms": ["Linux", "MacOS", "Windows"], "packageName": "markdown-it-py", "collectionURL": "https://github.com/executablebooks/markdown-it-py/releases", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2023-02-07T14:19:00.000-06:00", "value": "Reported to upstream."}, {"lang": "en", "time": "2023-02-22T06:39:56+01:00", "value": "Patched by upstream."}], "datePublic": "2023-02-22T05:39:56.000Z", "references": [{"url": "https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-173", "description": "CWE-173"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2023-02-22T22:02:35.556Z"}}}, "cveMetadata": {"cveId": "CVE-2023-26302", "state": "PUBLISHED", "dateUpdated": "2025-03-11T18:23:39.942Z", "dateReserved": "2023-02-21T22:36:47.685Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2023-02-22T22:02:35.556Z", "assignerShortName": "canonical"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:executablebooks:markdown-it-py:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E45476E-D78B-486D-9B62-30E7573AAA6A", "versionEndExcluding": "2.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.\n"}], "id": "CVE-2023-26302", "lastModified": "2025-03-11T19:15:38.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security@ubuntu.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-22T23:15:17.677", "references": [{"source": "security@ubuntu.com", "tags": ["Patch"], "url": "https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-173"}], "source": "security@ubuntu.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-173"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}